Update package description to reflect modern reality (support for
Thunderbird -- Lightning extension has not been a separate entity for
quite some time, and support for iOS clients -- iPhone and iPad, not
only iPhone).
Josef Schlehofer [Tue, 23 Jun 2026 20:01:26 +0000 (22:01 +0200)]
ci: labeler: avoid checking out fork codebase
Refactor the PR labeler workflow to checkout the base repository ref
instead of the pull request head ref from forks, resolving checkout
errors inside the pull_request_target context.
nantayo [Wed, 17 Jun 2026 03:27:07 +0000 (11:27 +0800)]
crun: update to 1.28
- remove outdated patch file
It was fixed upstream in containers/crun@9acf13d, so the patch file is no longer required.
- replace yajl with json-c
The JSON backend was switched from YAJL to json-c in containers/crun@b62cfdd, so --enable-embedded-yajl should be removed from CONFIGURE_ARGS and libjson-c should be add as a new dependency
net-snmp: fix 'bad number' warning when engineidtype is unset
Add a -n guard before the arithmetic comparison of engineidtype in
snmpd_engineid_add(). When the engineid UCI section exists but
engineidtype is not configured, the empty string is passed to
[ -ge ]/[ -le ] which causes 'sh: bad number' on every boot.
Dharmik Parmar [Mon, 11 May 2026 18:04:08 +0000 (23:34 +0530)]
watchcat: add optional failure timer reset
Add an opt-in reset_failure_timer option for restart_iface and
run_script modes.
When enabled, watchcat starts a fresh failure window after the
recovery action finishes before allowing another recovery action.
The existing behavior remains the default.
Document the intended default and reset_failure_timer timing
behavior in TIMINGS.md and use a safer string comparison for the
reset_failure_timer check.
Dirk Brenken [Mon, 22 Jun 2026 19:06:07 +0000 (21:06 +0200)]
adblock: update 4.5.6-2
- add f_mem() helper to read MemAvailable from /proc/meminfo,
replacing three duplicated inline reads in f_load, f_dns and f_jsnup
- cap the auto-detected CPU core count by available memory in f_load:
adb_cores is limited to MemAvailable / 48 (MiB per job), floored to at least 1 core;
this bounds the number of feeds processed in parallel on constrained devices,
a user-set adb_cores is still honored as a ceiling (the cap only ever lowers it).
- derive the GNU sort buffer size from available memory
- readme update:
- added a "low memory systems" recommendation to use
the zram-swap package (compressed swap) with a swappiness hint,
plus a sizing rule of thumb — this works for all DNS backends OOTB
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.)
Dirk Brenken [Sun, 21 Jun 2026 16:43:35 +0000 (18:43 +0200)]
banip: update 1.8.9-2
default feed updates:
- urlhaus, urlvir, webclient: switched from in to out
and added a tcp udp 80 443 port limit (destination feeds for LAN-initiated traffic)
- feodo, spamhaus, threat, threatview, proxy, tor, vpn, vpndc: switched from in to inout
- threatview: added url_6, as the source ships IPv4 and IPv6 in a single file
- country / asn: intentionally left on in; documented how to switch them to outbound/both
for the recurring "block connections to country X" case
- readme update:
- corrected the feed table to match the above,
- removed the stale drop row (replaced by spamhaus),
- and reworked the chain explanation to clarify the inbound-vs-outbound (source-IP vs destination-IP) model
- significantly expanded the custom-feeds section (all JSON fields, rule parameters, etc.
John Audia [Sun, 21 Jun 2026 10:18:22 +0000 (06:18 -0400)]
lxc: update to 7.0.0
Swtich to upstream recommended 7.0 LTS branch[1] which includes a fix
for CVE-2026-39402. Full changelog: https://github.com/lxc/lxc/releases/tag/v7.0.0
- Removed patches/021-remove-legacy-cgroup-support.patch due upstream
deprecated CGroupV1 support.
- Modified files/lxc-auto.init to remove the boot() function which mounted
legacy cgroup1 stuff as well. This PR will superceed
https://github.com/openwrt/packages/pull/27757 as a result.
- Added a version check script for the CI.
- Fix another CI failure with -Dmemfd-rexec=false
Note this release adds the ability to introduce landlock-sandboxing the
monitor process but that would depend on CONFIG_SECURITY_LANDLOCK in the
kernel. This can be added in a future PR if there is interest.
Wei-Ting Yang [Thu, 18 Jun 2026 04:34:14 +0000 (12:34 +0800)]
bash: update to 5.3 patch level 15
- Fix technically undefined behavior when comparing return value from
realloc to the original pointer
- Update mapfile patch 11, removing stray line and improving the
efficiency of the original fix
- Fix read builtin to avoid cases where -1 is used as an index into the
input buffer
Chester A. Unal [Tue, 9 Jun 2026 19:06:14 +0000 (20:06 +0100)]
bsbf-resources: update to GIT HEAD of 2026-06-19
Update bsbf-resources to the GIT HEAD of 2026-06-19.
- files/etc/uci-defaults/99-bsbf-bonding:
- Simplify the script and make sure multiple wan interfaces are processed
properly.
- Use routing table 1 instead of 100.
- Make it able to install the bsbf-bonding package without needing
bsbf-client-openwrt-installer.
- files/usr/sbin/bsbf-bonding:
- Move uninstall functionality to makefile.
- Bump PKG_RELEASE to 4.
- Add install rule to create /usr/share/nftables.d/ruleset-post.
files/etc/init.d/https-dns-proxy:
- Check if 'nft' command exists before generating rules.
- Add robust error handling for directory creation and file writing.
- Log errors when directory creation or file writing fails.
tests/run_tests.sh:
- Add test case for 'nft' binary absence, confirming no-op behavior.
- Add test case for mkdir failure during notrack rule generation.
Dirk Brenken [Wed, 17 Jun 2026 18:58:27 +0000 (20:58 +0200)]
travelmate: update 2.4.6-2
harden captive portal auto-login script handling:
* enforce the login-script allowlist in the backend instead of the
LuCI frontend only: canonicalize the configured path via 'readlink -f'
(defeats ../ traversal and symlink-to-interpreter tricks) and require a
regular, executable /etc/travelmate/*.login file before running it
* run the script in a noglob subshell ('set -f') so attacker-influenceable
script_args can no longer expand globs into the trusted script; field
splitting (multiple args) is preserved
* writing into /etc/travelmate/ is not covered by the luci-app-travelmate
ACL, so this limits the root-executed script to admin-placed login scripts
and closes a delegated-ACL to root command execution path.
python-jsonpath-ng: drop ply, six and decorator dependencies
jsonpath-ng 1.8.0 vendors ply as jsonpath_ng._ply and no longer imports
six or decorator, so none are required at runtime.
It builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via those packages' builds. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.
The jsonpath_ng CLI takes a required expression argument and has no version
flag, so the generic version check cannot detect the package version from it.
Add a test-version.sh override and assert __version__ in test.sh instead,
mirroring python-jmespath.
Dirk Brenken [Tue, 16 Jun 2026 19:30:33 +0000 (21:30 +0200)]
travelmate: release 2.4.6-1
- fix uplink teardown for bssid-pinned stations
the new implementaion reads the sta object once and parses fields by name via jshn
(isolated namespace, single fork). Bug finder: @adam8833 (#29768)
- add a fork-free f_normbssid() helper and normalize all config-side bssids
to upper case before comparison (in f_getcfg(), covering all callers, and
on the direct scan comparisons in f_main()).
- LuCI: adds a normBssid() helper function as well
net-snmp: fix service not restarting on config change
snmpd generates its runtime configuration in /var/run/snmpd.conf from
UCI during start_service(). However, since the procd instance command
line never changes, procd does not detect that a restart is needed when
the UCI config is modified.
Add 'procd_set_param file /etc/config/snmpd' so procd tracks the config
file and restarts snmpd when it changes. Without this, 'reload_service'
(triggered by procd_add_reload_trigger) re-creates an identical instance
definition and procd skips the restart, leaving stale configuration
active.
This also fixes a usability issue with SNMPv3: when changing a user's
authentication or privacy algorithm, net-snmp must restart to re-derive
localized keys via createUser. Without the restart, the daemon keeps
using cached key material and authentication fails.
Tested with net-snmp 5.9.4 on OpenWrt (aarch64 and ppc64).
Upstream only requires contextlib2 on Python <3.3, so it is never
pulled in on a Python 3.14 runtime.
schema builds through the setuptools.build_meta legacy backend but never
declared setuptools as a build dependency; it was only present in the host
build env transitively via contextlib2's build. Add python-setuptools/host
explicitly so the build no longer relies on that side effect.
Jack Lovell [Sun, 31 May 2026 14:49:39 +0000 (15:49 +0100)]
ocserv: support custom server SSL certificate
Add UCI options for the path to the server's SSL certificate and
private key. This enables the use of a certificate provided by an
external certificate authority instead of the default self-signed
certificate.
The self-signed certificate is still produced if it doesn't already
exist, and is used by default. So this change should be transparent to
existing users.
files/etc/init.d/adblock-fast:
- Increment `initCompat` to 17.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to config validation schema.
files/etc/uci-defaults/90-adblock-fast:
- Use `initCompat` from init script to stamp `config_compat`.
- Migrate `parallel_downloads` from boolean to numeric cap for compat < 15.
- Seed new `download_connect_timeout` from old `download_timeout`
for compat < 16.
- Add new `config_compat` and `config_version` stamping.
files/lib/adblock-fast/adblock-fast.uc:
- Increment package `compat` to 17.
- Introduce `task_slot_ram` for per-downloader memory budgeting.
- Add `download_connect_timeout`, `download_max_time`,
`download_allow_insecure` to `reload` triggers.
- Store `downloader` kind and track `_last_dl_timeout` status.
- Refine downloader detection: prefer curl, then uclient-fetch, then
GNU wget, finally generic wget.
- Update `curl` command flags for `--insecure`, `--connect-timeout`,
`--speed-limit`/`--speed-time`, `--max-time`.
- Update `uclient-fetch` flags for `--no-check-certificate`.
- Update `wget` flags for `--no-check-certificate`,
`--connect-timeout`, `--read-timeout`.
- Improve SSL support detection for uclient-fetch.
- Capture `curl` exit code 28 as a distinct timeout failure.
- Expand `get_text` cases for `errorDetectingFileType`,
`warningMissingRecommendedPackages` (args), `warningParallelDownloadsThrottled`,
`warningDownloadTimeout`.
- Allow `download_allow_insecure` for `get_url_filesize` calls.
- Set `download_allow_insecure` default to true in `config_schema`.
- Change `parallel_downloads` from boolean to integer `8` default in
`config_schema`.
- Add `download_connect_timeout` and `download_max_time` to `config_schema`.
- Read up to 4KB for `detect_file_type`.
- Improve `warningMissingRecommendedPackages` output: list missing
packages and use `apk` or `opkg` install command.
- Split `process_file_url` into parallelizable `prepare_file_url`
and serial `apply_result`, plus `emit_dl_line`.
- Implement memory-aware throttling for `parallel_downloads`.
- Revert to single `process_file_url` for serial uses and test runner.
- Correct `get_mem_available` to return current free memory only.
- Rename `get_mem_total` to `get_mem_available`.
python3: fix host PGO build failure on deep build paths
Python 3.14 made "forkserver" the default multiprocessing start method on
Linux, which binds an AF_UNIX socket under $TMPDIR during the PGO profile-run.
OpenWrt points TMPDIR at the deeply nested build tree, so the socket path can
exceed the 108-byte AF_UNIX limit and abort the host build with "AF_UNIX path
too long" in test_re (cpython#149527). Pin TMPDIR=/tmp for the host build.
Dengfeng Liu [Sun, 14 Jun 2026 11:09:34 +0000 (19:09 +0800)]
xfrpc: update to 5.06.909
Updated from 4.04.856 to 5.06.909.
Changes:
- Switch from git clone to tarball download
- Add start_time/end_time scheduling support for tcp/http/https/socks5
- Add service_type validation for tcp (ssh/mstsc/rdp/vnc/telnet)
- Add iod proxy type support
- Add WAN up auto-restart trigger
- Add -s startup parameter
Til Kaiser [Wed, 7 Jan 2026 13:24:29 +0000 (14:24 +0100)]
ifstat: fix build with GCC 15
ifstat fails to build with GCC 15 due to an incorrect detection of the
signal handler return type.
The configure script shipped with ifstat uses an obsolete K&R-style
declaration:
void (*signal())();
With GCC 15 this causes the signal() return type check to incorrectly
assume 'int' instead of 'void'. As a result, the generated code defines
signal handlers returning int, which conflicts with struct sigaction
expecting a void (*)(int) handler and leads to a build failure:
assignment to 'void (*)(int)' from incompatible pointer type
'int (*)(int)'
Enable autoreconf during the build to regenerate the configure
script, which correctly detects the signal handler type and fixes
the compilation error.
John Audia [Fri, 29 Aug 2025 11:28:17 +0000 (07:28 -0400)]
memtest86plus: add new package
Add package for memtest86+ and ability to boot directly into it from
existing grub menu. Both legacy and EFI packages are available and each
will provide the needed memtest86+ images plus a postinst and postrm to
handle the grub.cfg menu entries.
The images are tiny, adding at worst 154 kB to the kernel partition.
I do not have x86 box for testing but the memtest86plus-efi package
works as expected on my test machine (ie booting into the image and the
setup and removal of the grub.cfg menu entry).
Hannu Nyman [Sun, 14 Jun 2026 07:03:41 +0000 (10:03 +0300)]
collectd: ping - fix use-after-free when re-resolving a host
Add a patch fixing a possible crash, when a non-responding host is
tried to be pinged and retry attempts are limited by MaxMissed option.
> daemon.err: collectd[14133]: ping plugin: host 192.168.1.99 has not answered 3 PING requests, triggering resolve
> daemon.info: procd: Instance collectd::instance1 s in a crash loop 7 crashes, 3 seconds since last crash
John Audia [Sat, 11 Apr 2026 19:42:30 +0000 (15:42 -0400)]
nfs-kernel-server: fix up init scripts and exports
Add post-release patch to fix musl builds:
250-fh_key_file-fix-missing-string.h-inclusion.patch
v3 init:
- Mirror upstream systemd service; use nfsdctl to manage the server
- Add /etc/nfs.conf to restrict to NFSv3 only:
% cat /proc/fs/nfsd/versions
+3 -4 -4.0 -4.1 -4.2
v4 init:
- Remove dead procd_append_param -F from nfsdcld instance
- Add respawn to nfsv4.exportd and rpc.idmapd; exclude nfsdcld as it
daemonizes and would spawn duplicates under procd respawn
- Remove unused NFSDCLD_PID variable; nfsdcld writes no pidfile
- Add status_service() using pgrep; procd permanently misreports
nfsdcld as stopped due to its daemonization behavior
exports:
- Supply unified /etc/exports covering both v3 and v4 syntax so the
file survives switching between package variants
This upstream release has some peculiar commits, including disabling NFS
v4.0 by default and cache up calls migrated from /proc to netlink. In my
testing, two parameters are needed to the nfsv4.init file in order to maintain
functionality. Without these changes, there's a 90-second period where the
shares are simply unavailable.
Note that this cannot be merged until the changes to libnl have been
merged first. See: https://github.com/openwrt/openwrt/pull/22889
python-requests: use charset-normalizer instead of chardet
Switch runtime and host build deps from chardet to charset-normalizer,
the mandatory charset-detection backend since requests 2.26. Extend
test.sh to cover the new backend and bump PKG_RELEASE.
John Audia [Wed, 10 Jun 2026 20:40:11 +0000 (16:40 -0400)]
shadow: reintroduce newgidmap and newuidmap
The lxc-unprivileged package depends on both newgidmap and newuidmap
if users are installing and setting it up for the first time. dc52894
dropped both of the applets.
This change builds libusbid as a shared lib which builds a versioned
symbol which OpenWrt does not stage so build with --disable-shared
and --enable-static to avoid a failure.
John Audia [Wed, 10 Jun 2026 17:29:56 +0000 (13:29 -0400)]
dmidecode: update to 3.7
Upstream update.
Changelog from 3.5:
Version 3.7 (Thu Dec 18 2025)
- [COMPATIBILITY] Use binary unit prefixes.
- [COMPATIBILITY] Rename BIOS to Firmware.
- [PORTABILITY] Improve variable declarations.
- [PORTABILITY] Stop open-coding the u64 type.
- [PORTABILITY] Use unaligned memory accesses unconditionally.
- [PORTABILITY] No longer build with -Winline.
- Support for SMBIOS 3.8.0. This includes a new processor family.
- Support for SMBIOS 3.9.0. This includes chassis type name adjustments,
new rack attributes, slot ID for more slot types, and new memory device
form factors and types.
- Decode HPE OEM records 193, 195, 202, 211, 226, 229, 232 and 244.
- Update HPE OEM records 203, 216, 242 and 245.
- EDSFF slot names now include their .S/.L suffix.
Version 3.6 (Wed Apr 24 2024)
- [PORTABILITY] Use -DALIGNMENT_WORKAROUND on arm.
- [PORTABILITY] Read SMBIOS entry point via kenv on DragonFly BSD.
- Support for SMBIOS 3.6.0. This includes new memory device types, new
processor upgrades, and Loongarch support.
- Support for SMBIOS 3.7.0. This includes new port types, new processor
upgrades, new slot characteristics and new fields for memory modules.
- Add bash completion.
- Decode HPE OEM records 197, 239 and 245.
- Implement options --list-strings and --list-types.
- Update HPE OEM records 203, 212, 216, 221, 233, 236, 237, 238 and 242.
- Update Redfish support.
- Bug fixes:
Fix option --from-dump for user root
Fix enabled slot characteristics not being printed
- Minor improvements:
Print slot width on its own line
Use standard strings for slot width
Daniel Golle [Tue, 9 Jun 2026 06:57:59 +0000 (07:57 +0100)]
gpgme: update to version 2.1.0
New encryption result flags "is_de_vs" and "beta_compliance", a new
GPGME_DECRYPT_SESSION_HASH decryption flag and session_hash result
field, CMS signature attribute support via gpgme_sig_notation_add, a
new "export-filter" context flag, plus a gpgsm lockup fix and a
passphrase cancel handling fix.
https://gnupg.org/ftp/gcrypt/gpgme/ Signed-off-by: Daniel Golle <redacted>
Olekhov Vasilii [Fri, 15 May 2026 17:02:36 +0000 (20:02 +0300)]
lpac: fix env vars for lpac.sh wrapper
This patch fixes usage of `LPAC_QMI_DEV` and `LPAC_QMI_DEBUG`
environment variables.
OpenWRT upstream patch for `lpac` provides `uqmi` backend that uses these vars
instead of `LPAC_APDU_QMI_DEVICE` and `LPAC_APDU_QMI_DEBUG` respectively.
Added test-version.sh script since lpac version check is non-standart
Daniel Golle [Tue, 9 Jun 2026 03:42:02 +0000 (04:42 +0100)]
transmission: update to version 4.1.2
Bugfix release fixing 20+ bugs plus minor performance improvements,
notably a 4.1.0 duplicate HTTP announce fix and a fix for downloads
stalling at 99%.
Daniel Golle [Tue, 9 Jun 2026 07:01:15 +0000 (08:01 +0100)]
opentracker: update to latest git HEAD
1c7fac4 Reduce chance of collisions ec74b83 Fix connection ids. They were broken for the last 14 years and never
used more than the remote ip as seed. Thanks to Tracy Rogers
https://erdgeist.org/gitweb/opentracker/ Signed-off-by: Daniel Golle <redacted>
Daniel Golle [Tue, 9 Jun 2026 04:02:53 +0000 (05:02 +0100)]
exfatprogs: update to version 1.4.1
1.4.0 adds exFAT partition table support (mkfs partition-table creation,
fsck --put-mbr/--clear-mbr), a user-supplied --upcase table option and
chdosattr/lsdosattr DOS-attribute utilities; 1.4.1 fixes missing headers
in the release tarball. The new MBR and foreign-filesystem detection
links libblkid and fts, so add +libblkid and +USE_MUSL:musl-fts.
https://github.com/exfatprogs/exfatprogs/releases/tag/1.4.0
https://github.com/exfatprogs/exfatprogs/releases/tag/1.4.1 Signed-off-by: Daniel Golle <redacted>
Daniel Golle [Tue, 9 Jun 2026 06:44:37 +0000 (07:44 +0100)]
ccid: update to version 1.8.0
New reader support (GLSolutions NM61, Identiv uTrust FIDO2, Kensington
VeriMark NFC+, several Pol Henarejos Pico devices and more), removes the
16 reader limitation, and fixes crashes and race conditions in the
multi-slot code.
Upstream removes the autotools build system in favour of Meson, so port
the package to meson.mk and drop 010-macos.patch, which patched the now
removed configure.ac. The reader bundle install path is taken from
libpcsclite.pc usbdropdir (/usr/lib/pcsc/drivers, unchanged); udev rules
stay disabled as before.
https://ccid.apdu.fr/files/ Signed-off-by: Daniel Golle <redacted>
Daniel Golle [Tue, 9 Jun 2026 04:44:31 +0000 (05:44 +0100)]
pcsc-lite: update to version 2.5.0
- Do not limit to 16 readers only
- Remove support of autotools
- Fix a crash when rescanning serial configs
- Fix a memory leak in Polkit
- tokenparser: avoid a crash with corrupted Info.plist files
https://pcsclite.apdu.fr/ Signed-off-by: Daniel Golle <redacted>
git.99rst.org / openwrt-packages.git / log